Effective risk management requires identifying emerging risks. Too often, risk assessments shuffle “known knowns” around on a risk or heat map, leaving executives and directors asking, “Can you tell me something I don’t know?”
Emerging risks are newly developing risks that cannot yet be fully assessed but that could, in the future, affect the viability of an organization’s strategy. One way to identify them is to focus on whether the critical assumptions underlying the strategy are becoming, or have become, invalid. The reality for every business is that its fundamentals eventually change. Using the critical assumptions underlying its strategy, management should identify relevant drivers to monitor the external environment for changes that could invalidate one or more of those assumptions.
Another way to identify emerging risks is to pay attention to global trends. Earlier this year, the World Economic Forum (WEF) published its update on global risks.1 This study refers to a number of risks in five broad categories: economic, environmental, societal, geopolitical and technological. These categories are likely areas in which most of the external drivers impacting a company might be found. The WEF organizes the various risks under two broad global themes to illustrate their interconnectivity – economic disparity and global governance failures. Within these two themes, there are the three key risk “clusters” listed below:
- Macroeconomic imbalances – These risks arise from the tension between the increasing wealth and influence of emerging economies and the high debt levels of advanced economies. They include such risks as a financial crisis, asset price collapse and currency volatility, and are fueled by unsustainable savings and trade imbalances between and among nations.
- The illegal economy – These risks arise from a networked world, governance failures and economic disparity. They include corruption, illicit trade, organized crime and fragile states. Growing illicit trade weakens states, threatens development and sustains political instability.
- Water-food-energy – Growing population and prosperity are driving unsustainable pressure on global resources. With demand for vital resources increasing by 30 to 50 percent over the next two decades, shortages could drive extreme commodity price volatility and create social and political instability and, even worse, geopolitical conflict.
These risk groupings provide insight into possible forces that could shape the future, forces some companies may not be thinking about today. The question is whether the organization is prepared to respond to the high-impact, high-persistence risks that might be spawned by these forces, such as another liquidity/credit crunch, a slowing Chinese economy, threats from new technologies or a catastrophic disruption of a critical region’s infrastructure.
Emerging risks are not just driven externally. They also emerge as a result of an organization’s pre-emptive actions. For example, a decision to build new plants and hire people in a new market typically alters the entity’s risk profile. Management must carefully consider the actual or anticipated effects of such actions (e.g., exposure to political/sovereign risk, cultural issues, a different regulatory regime and catastrophic events).
Scenarios are a useful tool for identifying emerging risks, provided worst-case scenarios are extreme enough. The extent of interconnectivity of supply chains, business-to-business transactions and people to people interactions spawned by globalization, competition, technology, lean manufacturing and other drivers have not only increased the speed of business but have also raised the stakes of a crisis.
The Japanese supply chain disruption taught a valuable lesson in this respect. When it comes to physical phenomena (e.g., weather, earthquakes, volcanic eruptions, flooding), arbitrary curtailments in the time period used to gather empirical data supporting decision models can create a false sense of security. Based on prior studies, the catastrophic Japanese tsunami was a 1,000-year event.
Hurricane Katrina and the Australian flooding are other examples of worstcase catastrophes. Look back far enough because the geological clock is ticking. If a single-source supplier
is in the wrong footprint when an extreme event occurs, there will be consequences for its customers if it lacks a well-thought-out response plan.
A final point management should consider is the organization’s game-changing risks. WEF includes several risks to watch due to their “severe, unexpected or underappreciated consequences.” These risks include cybersecurity, demographic changes, resource security, retrenchment from globalization, infrastructure fragility and fiscally distressed cities. While not all of these risks are relevant to a given company, some may be.
Questions for Boards
Following are some suggested questions that boards of directors may consider, based on the risks inherent in the entity’s operations:
- Is there anything management truly fears, and are those concerns out in the open? Does the organization consider interrelationships among risks to identify relevant risk themes?
- Is the board apprised in a timely manner of significant changes in the enterprise’s risk profile? Is there a process for identifying emerging risks? Does the exercise result in appropriate response plans?
- Is the board satisfied that management is periodically monitoring changes in the business environment to identify potential impacts on the assumptions and risks inherent in the corporate strategy?
How Protiviti Can Help
Protiviti assists boards and executive management with assessing their enterprise’s risks and capabilities for managing those risks. We help organizations identify and prioritize their risks, including emerging risks that can impair their reputation, brand image and enterprise value.
1Global Risks 2011, Sixth Edition: An Initiative of the Risk Response Network, World Economic Forum, January 2011.
Board Perspectives: Risk Oversight (Issue 23)